{"record":{"id":"bdf9a15615df963e","repo":"rancher/rancher","slug":"certificate-chain-is-not-complete-please-check-if","errorCode":null,"errorMessage":"Certificate chain is not complete, please check if all needed intermediate certificates are included in the server certificate (in the correct order) and if the cacerts setting in Rancher either contains the correct CA certificate (in the case of using self signed certificates) or is empty (in the case of using a certificate signed by a recognized CA). Certificate information is displayed above. error: %s","messagePattern":"Certificate chain is not complete, please check if all needed intermediate certificates are included in the server certificate \\(in the correct order\\) and if the cacerts setting in Rancher either contains the correct CA certificate \\(in the case of using self signed certificates\\) or is empty \\(in the case of using a certificate signed by a recognized CA\\)\\. Certificate information is displayed above\\. error: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cmd/agent/main.go","lineNumber":181,"sourceCode":"\t\t\tsystemStoreConnectionCheckRequired = false\n\t\t}\n\t\ttransport.CloseIdleConnections()\n\t} else if cluster.CAStrictVerify() {\n\t\tlogrus.Errorf(\"Strict CA verification is enabled but encountered error finding root CA\")\n\t\tos.Exit(1)\n\t}\n\n\tif systemStoreConnectionCheckRequired {\n\t\t// Check if secure connection can be made successfully\n\t\tvar httpClient = &http.Client{\n\t\t\tTimeout: time.Second * 5,\n\t\t}\n\t\t_, err = httpClient.Get(server)\n\t\tif err != nil {\n\t\t\tif strings.Contains(err.Error(), \"x509:\") {\n\t\t\t\tcertErr := err\n\t\t\t\tif strings.Contains(err.Error(), \"certificate signed by unknown authority\") {\n\t\t\t\t\tcertErr = fmt.Errorf(\"Certificate chain is not complete, please check if all needed intermediate certificates are included in the server certificate (in the correct order) and if the cacerts setting in Rancher either contains the correct CA certificate (in the case of using self signed certificates) or is empty (in the case of using a certificate signed by a recognized CA). Certificate information is displayed above. error: %s\", err)\n\t\t\t\t}\n\t\t\t\tif strings.Contains(err.Error(), \"certificate has expired or is not yet valid\") {\n\t\t\t\t\tcertErr = fmt.Errorf(\"Server certificate is not valid, please check if the host has the correct time configured and if the server certificate has a notAfter date and time in the future. Certificate information is displayed above. error: %s\", err)\n\t\t\t\t}\n\t\t\t\tif strings.Contains(err.Error(), \"because it doesn't contain any IP SANs\") || strings.Contains(err.Error(), \"certificate is not valid for any names, but wanted to match\") || strings.Contains(err.Error(), \"cannot validate certificate for\") {\n\t\t\t\t\tcertErr = fmt.Errorf(\"Server certificate does not contain correct DNS and/or IP address entries in the Subject Alternative Names (SAN). Certificate information is displayed above. error: %s\", err)\n\t\t\t\t}\n\t\t\t\tinsecureClient := &http.Client{\n\t\t\t\t\tTimeout: time.Second * 5,\n\t\t\t\t\tTransport: &http.Transport{\n\t\t\t\t\t\tTLSClientConfig: &tls.Config{\n\t\t\t\t\t\t\tInsecureSkipVerify: true,\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t\tres, err := insecureClient.Get(server)\n\t\t\t\tif err != nil {\n\t\t\t\t\tlogrus.Errorf(\"Could not connect to %s: %v\", server, err)","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/cmd/agent/main.go#L163-L199","documentation":"Produced during rancher-agent startup in cmd/agent/main.go: the agent probes the server URL with a plain http.Client (system trust store) and, when the TLS handshake fails with 'x509: certificate signed by unknown authority', wraps it in this remediation message. It means the agent host could not build a chain from the server certificate to a trusted root: intermediates are missing from the served chain, or the Rancher cacerts setting does not carry the right CA. The agent then reconnects with InsecureSkipVerify to dump certificate details for diagnosis.","triggerScenarios":"Agent registration/connect against a server URL where TLS serves an incomplete chain (leaf without intermediates, or wrong intermediate order), or Rancher's cacerts setting holds a CA that did not sign the served certificate.","commonSituations":"Public CA-issued certs deployed as leaf-only (Go does not use the system intermediate store the same way browsers do); self-signed certs rotated without updating the cacerts setting; corporate TLS-intercepting proxies re-signing traffic with an unknown root; load balancer (nginx/traefik) configured without the intermediate bundle.","solutions":["Redeploy the server certificate as a full chain: leaf first, then intermediate(s), in the correct order","For self-signed certs, set the Rancher cacerts setting to the exact CA certificate that signed the chain; for public CA certs, leave cacerts empty","Check the certificate dump the agent prints above the error to confirm served chain and ordering","If a proxy intercepts TLS, add its root CA to the agent host trust store"],"exampleFix":"# before: server cert contains only the leaf\nserver.crt = <leaf>\n\n# after: full chain in order\nserver.crt = <leaf>\n<cintermediate>\n<root-optional>","handlingStrategy":"validation","validationCode":"// Verify the served chain against the system roots before deploying agents.\nconn, err := tls.Dial(\"tcp\", host, &tls.Config{})\nif err != nil {\n    log.Fatalf(\"TLS verification failed, fix chain/cacerts first: %v\", err)\n}\nconn.ConnectionState().PeerCertificates // chain as served","typeGuard":"func isIncompleteChainErr(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"certificate signed by unknown authority\")\n}","tryCatchPattern":"if _, err := httpClient.Get(server); err != nil {\n    if isIncompleteChainErr(err) {\n        // deployment guardrail: do not start agents; fix server chain or cacerts setting\n    }\n}","preventionTips":["Deploy server certs as leaf+intermediates bundles, leaf first","Automate cert-renewal checks on notAfter for the full chain","After rotating certs, update the Rancher cacerts setting in the same change"],"tags":["tls","x509","certificate","agent","network"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}